Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Archive
2018
September

CVEs published in September 2018

1,223 vulnerabilities, 177 critical, 3 exploited.

Known exploitedIn KEVPublic exploitFix available

gxlcmsGxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.CVE-2018-166556.1 MediumSeptember 7, 2018
zurmo crmZurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1...CVE-2018-166546.1 MediumSeptember 7, 2018
rejucms project rejucmsrejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.CVE-2018-166536.1 MediumSeptember 7, 2018
phpmyfaqThe admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.CVE-2018-166517.2 HighSeptember 7, 2018
phpmyfaqphpMyFAQ CSRFCVE-2018-16650Fix available8.8 HighSeptember 7, 2018
mozilla firefox, firefox esr, thunderbird +2 moreA same-origin policy violation allowing the theft of cross-origin URL entries when using a meta...CVE-2018-18499Fix available6.5 MediumSeptember 7, 2018
google chromeAn object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome...CVE-2018-174578.8 HighSeptember 7, 2018
debian linux, linux kernel, canonical ubuntu linux +2 moreAn issue was discovered in the Linux kernel before 4.18.6. An information leak in...CVE-2018-16658Fix available6.1 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreA missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81...CVE-2018-16088Fix available6.5 MediumSeptember 7, 2018
google chromeLack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a...CVE-2018-16087Fix available4.3 MediumSeptember 7, 2018
google chromeInsufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed...CVE-2018-16086Fix available5.4 MediumSeptember 7, 2018
google chromeA use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote...CVE-2018-16085Fix available8.8 HighSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreThe default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81...CVE-2018-16084Fix available6.1 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreAn out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0...CVE-2018-16083Public exploitFix available8.8 HighSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreAn out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote...CVE-2018-16082Fix available6.5 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreAllowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69...CVE-2018-16081Fix available7.4 HighSeptember 7, 2018
google chromeA missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0...CVE-2018-16080Fix available6.5 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreA race condition between permission prompts and navigations in Prompts in Google Chrome prior to...CVE-2018-16079Fix available5.3 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreUnsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed...CVE-2018-16078Fix available6.5 MediumSeptember 7, 2018
google chromeObject lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker...CVE-2018-16077Fix available6.5 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreMissing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker...CVE-2018-16076Fix available8.8 HighSeptember 7, 2018
google chromeInsufficient file type enforcement in Blink in Google Chrome prior to 69.0.3497.81 allowed a...CVE-2018-16075Fix available5.3 MediumSeptember 7, 2018
google chromeInsufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed...CVE-2018-16074Fix available6.5 MediumSeptember 7, 2018
google chromeInsufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed...CVE-2018-16073Fix available6.5 MediumSeptember 7, 2018
google chrome, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreA use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to...CVE-2018-16071Public exploitFix available8.8 HighSeptember 7, 2018
google chromeInteger overflows in Skia in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to...CVE-2018-16070Fix available8.8 HighSeptember 7, 2018
google chromeUnintended floating-point error accumulation in SwiftShader in Google Chrome prior to 69.0.3497...CVE-2018-16069Fix available6.5 MediumSeptember 7, 2018
google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreMissing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to...CVE-2018-16068Fix available9.6 CriticalSeptember 7, 2018
google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreA use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to...CVE-2018-16067Fix available6.5 MediumSeptember 7, 2018
google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreA use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to...CVE-2018-16066Fix available6.5 MediumSeptember 7, 2018
google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreA Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0...CVE-2018-16065Fix available8.8 HighSeptember 7, 2018
ivanti connect secure, pulsesecure pulse connect secure, pulse policy secure +2 moreA vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX...CVE-2018-63209.8 CriticalSeptember 6, 2018
artifex mupdfIn Artifex MuPDF 1.13.0, the fz_append_byte function in fitz/buffer.c allows remote attackers to...CVE-2018-16648Fix available5.5 MediumSeptember 6, 2018
artifex mupdfIn Artifex MuPDF 1.13.0, the pdf_get_xref_entry function in pdf/pdf-xref.c allows remote...CVE-2018-16647Fix available5.5 MediumSeptember 6, 2018
furuno felcom 250 firmware, felcom 500 firmware +1 moreFURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication.CVE-2018-165909.8 CriticalSeptember 6, 2018
nasm netwide assemblerasm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the...CVE-2018-16517Public exploitFix available5.5 MediumSeptember 6, 2018
technicolor tg588v, tg588v firmware +1 more** DISPUTED ** Technicolor TG588V V2 devices allow remote attackers to cause a denial of service ...CVE-2018-16310Disputed6.5 MediumSeptember 6, 2018
userproplugin userproThe UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a...CVE-2018-162856.1 MediumSeptember 6, 2018
pulsesecure pulse secure desktop clientIn Pulse Secure Pulse Desktop Client 5.3RX before 5.3R5 and 9.0R1, there is a Privilege...CVE-2018-162616.8 MediumSeptember 6, 2018
pulsesecure pulse secure desktop clientThe Pulse Secure Desktop (macOS) has a Privilege Escalation Vulnerability.CVE-2018-158657.8 HighSeptember 6, 2018
pulsesecure pulse secure desktop clientThe Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability.CVE-2018-157495.5 MediumSeptember 6, 2018
pulsesecure pulse secure desktop clientThe Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation...CVE-2018-157265.3 MediumSeptember 6, 2018
ivanti connect secure, pulsesecure pulse connect secure, pulse policy secure +2 moredownload.cgi in Pulse Secure Pulse Connect Secure 8.1RX before 8.1R13 and 8.3RX before 8.3R4 and...CVE-2018-143666.1 MediumSeptember 6, 2018
myadrenalin adrenalinA Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS...CVE-2018-12234Public exploit6.1 MediumSeptember 6, 2018
imagemagickImageMagick 7.0.8-6 has a memory leak vulnerability in the TIFFWritePhotoshopLayers function in...CVE-2018-166416.5 MediumSeptember 6, 2018
ietf internet key exchange, strongswan +1 moreCVE-2018-5389CVE-2018-53895.9 MediumSeptember 6, 2018
adobe experience managerAdobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting...CVE-2018-50056.1 MediumSeptember 6, 2018
html-js doracmsMultiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3...CVE-2018-166225.4 MediumSeptember 6, 2018
kohaKOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains...CVE-2018-10006706.1 MediumSeptember 6, 2018
kohaKOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains...CVE-2018-10006698.8 HighSeptember 6, 2018
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open